1

import re
#!/usr/bin/env python3

from pwn import *

e = ELF("./check-list_patched_patched")

context.binary = e  # Set the target binary for pwntools
# context.terminal = ["kitty", "-e"]  # Terminal to use for GDB debugging
context.terminal = ['tmux', 'splitw', '-h'] # Terminal to use for GDB debugging
HOST = "10.10.10.10"  # Remote host IP
PORT = 1337  # Remote port

gdb_script = """
b main
continue
"""

def conn():
    # Start local process with optional GDB or connect to remote
    if args.LOCAL:
        # p = process([e.path], aslr=False)
        p = process([e.path])
        if args.GDB:
            gdb.attach(p, gdbscript=gdb_script)
    else:
        p = remote(HOST, PORT)
    return p

def main():
    p = conn()

    pat = re.compile(r"\[rbp-0x([0-9A-Fa-f]+)\],0x([0-9A-Fa-f]+)")
    comp = [0]*0x400
    ops  = [0]*0x400

    with open("raw-cmp-2.txt") as f:
        for line in f:
            m = pat.search(line)
            if m:
                off = int(m.group(1), 16) -1 
                val = int(m.group(2), 16)
                comp[off] = val

    pattern = re.compile(r'\b(add|sub)\s+BYTE PTR\s+\[rbp-(0x[0-9a-fA-F]+)\],(0x[0-9a-fA-F]+)')
    with open("raw-op.txt") as f:
        for line in f:
            m = pattern.search(line)
            if m:
                op  = m.group(1)
                off = int(m.group(2), 16) -1 
                val = int(m.group(3), 16)
                if op == "add":
                    ops[off] += val
                else:
                    ops[off] -= val

    inp = [(comp[i] - ops[i]) & 0xFF for i in range(0x400)]

    for b in inp:
        print(hex(b))

    with open("input.bin", "wb") as f:
        p.send(bytes(inp[::-1]))

    p.interactive()

if __name__ == "__main__":
    main()